公开(公告)号：US20220222358A1

公开(公告)日：2022-07-14

申请号：US17710723

申请日：2022-03-31

Applicant: Intel Corporation

Inventor： Ravi Sahita ,  Dror Caspi ,  Vedvyas Shanbhogue ,  Vincent Scarlata ,  Anjo Lucas Vahldiek-Oberwagner ,  Haidong Xia ,  Mona Vij

IPC: G06F21/60 ,  G06F21/53 ,  G06F21/54 ,  G06F9/455

Abstract: Scalable cloning and replication for trusted execution environments is described. An example of a computer-readable storage medium includes instructions for receiving a selection of a point to capture a snapshot of a baseline trust domain (TD) or secure enclave, the TD or secure enclave being associated with a trusted execution environment (TEE) of a processor utilized for processing of a workload; initiating cloning of the TD or secure enclave from a source platform to an escrow platform; generating an escrow key to export the snapshot to the escrow platform; and exporting a state of the TD or secure enclave to the escrow platform, the state being sealed with a sealing key.

公开(公告)号：US20180088976A1

公开(公告)日：2018-03-29

申请号：US15278592

申请日：2016-09-28

Applicant: Intel Corporation

Inventor： Rebekah M. Leslie-Hurd ,  Carlos V. Rozas ,  Dror Caspi

IPC: G06F9/455 ,  G06F12/1045 ,  G06F12/0817

CPC classification number: G06F9/45558 ,  G06F11/34 ,  G06F12/1036 ,  G06F12/1045 ,  G06F12/121 ,  G06F12/1441 ,  G06F12/1491 ,  G06F21/602 ,  G06F21/62 ,  G06F2009/45591 ,  G06F2212/152 ,  G06F2212/502 ,  G06F2212/656 ,  G06F2212/657

Abstract: A processing system includes an execution unit, communicatively coupled to an architecturally-protected memory, the execution unit comprising a logic circuit to execute a virtual machine monitor (VMM) that supports a virtual machine (VM) comprising a guest operating system (OS) and to implement an architecturally-protected execution environment, wherein the logic circuit is to responsive to executing a blocking instruction by the guest OS directed at a first page stored in the architecturally-protected memory during a first time period identified by a value stored in a first counter, copy the value from the first counter to a second counter, responsive to executing a first tracking instruction issued by the VMM, increment the value stored in the first counter, and set a flag to indicate successful execution of the second tracking instruction.

公开(公告)号：US12013954B2

公开(公告)日：2024-06-18

申请号：US17710723

申请日：2022-03-31

Applicant: Intel Corporation

Inventor： Ravi Sahita ,  Dror Caspi ,  Vedvyas Shanbhogue ,  Vincent Scarlata ,  Anjo Lucas Vahldiek-Oberwagner ,  Haidong Xia ,  Mona Vij

IPC: G06F21/60 ,  G06F9/455 ,  G06F21/53 ,  G06F21/54

CPC classification number: G06F21/602 ,  G06F9/45558 ,  G06F21/53 ,  G06F21/54 ,  G06F2009/4557 ,  G06F2009/45587 ,  G06F2009/45595

Abstract: Scalable cloning and replication for trusted execution environments is described. An example of a computer-readable storage medium includes instructions for receiving a selection of a point to capture a snapshot of a baseline trust domain (TD) or secure enclave, the TD or secure enclave being associated with a trusted execution environment (TEE) of a processor utilized for processing of a workload; initiating cloning of the TD or secure enclave from a source platform to an escrow platform; generating an escrow key to export the snapshot to the escrow platform; and exporting a state of the TD or secure enclave to the escrow platform, the state being sealed with a sealing key.

公开(公告)号：US11422811B2

公开(公告)日：2022-08-23

申请号：US17098129

申请日：2020-11-13

Applicant: Intel Corporation

Inventor： Gideon Gerzon ,  Dror Caspi ,  Arie Aharon ,  Ido Ouziel

IPC: G06F12/0804 ,  G06F9/30 ,  G06F9/455

Abstract: A processor includes a global register to store a value of an interrupted block count. A processor core, communicably coupled to the global register, may, upon execution of an instruction to flush blocks of a cache that are associated with a security domain: flush the blocks of the cache sequentially according to a flush loop of the cache; and in response to detection of a system interrupt: store a value of a current cache block count to the global register as the interrupted block count; and stop execution of the instruction to pause the flush of the blocks of the cache. After handling of the interrupt, the instruction may be called again to restart the flush of the cache.

公开(公告)号：US11138320B2

公开(公告)日：2021-10-05

申请号：US16228206

申请日：2018-12-20

Applicant: Intel Corporation

Inventor： Dror Caspi ,  Arie Aharon ,  Gideon Gerzon ,  Hormuzd Khosravi

IPC: G06F21/00 ,  G06F21/60 ,  H04L9/08 ,  H04L9/14

Abstract: Implementations describe providing secure encryption key management in trust domains. In one implementation, a processing device includes a key ownership table (KOT) that is protected against software access. The processing device further includes a processing core to execute a trust domain resource manager (TDRM) to create a trust domain (TD) and a randomly-generated encryption key corresponding to the TD, the randomly-generated encryption key identified by a guest key identifier (GKID) and protected against software access from at least one of the TDRM or other TDs, the TDRM is to reference the KOT to obtain at least one unassigned host key identifier (HKID) utilized to encrypt a TD memory, the TDRM is to assign the HKID to the TD by marking the HKID in the KOT as assigned, and configure the randomly-generated encryption key on the processing device by associating the randomly-generated encryption key with the HKID.

公开(公告)号：US10705976B2

公开(公告)日：2020-07-07

申请号：US16023537

申请日：2018-06-29

Applicant: Intel Corporation

Inventor： Ravi Sahita ,  Barry E. Huntley ,  Vedvyas Shanbhogue ,  Dror Caspi ,  Baruch Chaikin ,  Gilbert Neiger ,  Arie Aharon ,  Arumugam Thiyagarajah

IPC: G06F12/1036 ,  G06F12/14 ,  G06F9/455 ,  G06F12/109 ,  G06F21/53 ,  G06F21/78 ,  G06F12/1009 ,  G06F12/02

Abstract: Examples include a processor including at least one untrusted extended page table (EPT), circuitry to execute a set of instructions of the instruction set architecture (ISA) of the processor to manage at least one secure extended page table (SEPT), and a physical address translation component to translate a guest physical address of a guest physical memory to a host physical address of a host physical memory using one of the at least one untrusted EPT and the at least one SEPT.

公开(公告)号：US10552344B2

公开(公告)日：2020-02-04

申请号：US15854278

申请日：2017-12-26

Applicant: Intel Corporation

Inventor： Carlos V. Rozas ,  Ittai Anati ,  Francis X. McKeen ,  Krystof Zmudzinski ,  Ilya Alexandrovich ,  Somnath Chakrabarti ,  Dror Caspi ,  Meltem Ozsoy

IPC: G06F12/14 ,  G06F12/08 ,  G06F12/10 ,  G06F3/06 ,  G06F12/0806 ,  G06F12/0868 ,  G06F12/1009 ,  G06F12/1027 ,  G06F12/128

Abstract: A secure enclave circuit stores an enclave page cache map to track contents of a secure enclave in system memory that stores secure data containing a page having a virtual address. An execution unit is to, in response to a request to evict the page from the secure enclave: block creation of translations of the virtual address; record one or more hardware threads currently accessing the secure data in the secure enclave; send an inter-processor interrupt to one or more cores associated with the one or more hardware threads, to cause the one or more hardware threads to exit the secure enclave and to flush translation lookaside buffers of the one or more cores; and in response to detection of a page fault associated with the virtual address for the page in the secure enclave, unblock the creation of translations of the virtual address.

公开(公告)号：US10180854B2

公开(公告)日：2019-01-15

申请号：US15278592

申请日：2016-09-28

Applicant: Intel Corporation

Inventor： Rebekah M. Leslie-Hurd ,  Carlos V. Rozas ,  Dror Caspi

IPC: G06F9/455 ,  G06F12/1045 ,  G06F12/0817

Abstract: A processing system includes an execution unit, communicatively coupled to an architecturally-protected memory, the execution unit comprising a logic circuit to execute a virtual machine monitor (VMM) that supports a virtual machine (VM) comprising a guest operating system (OS) and to implement an architecturally-protected execution environment, wherein the logic circuit is to responsive to executing a blocking instruction by the guest OS directed at a first page stored in the architecturally-protected memory during a first time period identified by a value stored in a first counter, copy the value from the first counter to a second counter, responsive to executing a first tracking instruction issued by the VMM, increment the value stored in the first counter, and set a flag to indicate successful execution of the second tracking instruction.

公开(公告)号：US11461244B2

公开(公告)日：2022-10-04

申请号：US16227386

申请日：2018-12-20

Applicant: Intel Corporation

Inventor： Ido Ouziel ,  Arie Aharon ,  Dror Caspi ,  Baruch Chaikin ,  Jacob Doweck ,  Gideon Gerzon ,  Barry E. Huntley ,  Francis X. McKeen ,  Gilbert Neiger ,  Carlos V. Rozas ,  Ravi L. Sahita ,  Vedvyas Shanbhogue ,  Assaf Zaltsman ,  Hormuzd M. Khosravi

IPC: G06F11/30 ,  G06F12/14 ,  G06F9/455 ,  G06F11/07 ,  G06F12/02 ,  G06F12/0817 ,  G06F21/53 ,  G06F21/57 ,  G06F21/60 ,  G06F21/79

Abstract: Implementations described provide hardware support for the co-existence of restricted and non-restricted encryption keys on a computing system. Such hardware support may comprise a processor having a core, a hardware register to store a bit range to identify a number of bits, of physical memory addresses, that define key identifiers (IDs) and a partition key ID identifying a boundary between non-restricted and restricted key IDs. The core may allocate at least one of the non-restricted key IDs to a software program, such as a hypervisor. The core may further allocate a restricted key ID to a trust domain whose trust computing base does not comprise the software program. A memory controller coupled to the core may allocate a physical page of a memory to the trust domain, wherein data of the physical page of the memory is to be encrypted with an encryption key associated with the restricted key ID.

公开(公告)号：US11139967B2

公开(公告)日：2021-10-05

申请号：US16228002

申请日：2018-12-20

Applicant: Intel Corporation

Inventor： Ido Ouziel ,  Arie Aharon ,  Dror Caspi ,  Baruch Chaikin ,  Jacob Doweck ,  Gideon Gerzon ,  Barry E. Huntley ,  Francis X. Mckeen ,  Gilbert Neiger ,  Carlos V. Rozas ,  Ravi L. Sahita ,  Vedvyas Shanbhogue ,  Assaf Zaltsman

IPC: H04L9/08 ,  G06F9/455 ,  G06F12/1009 ,  G06F21/60 ,  G06F21/62

Abstract: A processor includes a processor core. A register of the core is to store: a bit range for a number of address bits of physical memory addresses used for key identifiers (IDs), and a first key ID to identify a boundary between non-restricted key IDs and restricted key IDs of the key identifiers. A memory controller is to: determine, via access to bit range and the first key ID in the register, a key ID range of the restricted key IDs within the physical memory addresses; access a processor state that a first logical processor of the processor core executes in an untrusted domain mode; receive a memory transaction, from the first logical processor, including an address associated with a second key ID; and generate a fault in response to a determination that the second key ID is within a key ID range of the restricted key IDs.